wood-fired-tasks 1.12.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (553) hide show
  1. package/AGENTS.md +112 -0
  2. package/CHANGELOG.md +271 -0
  3. package/CLAUDE.md +21 -0
  4. package/LICENSE +21 -0
  5. package/README.md +687 -0
  6. package/SECURITY.md +299 -0
  7. package/dist/api/hooks/error-handler.d.ts +6 -0
  8. package/dist/api/hooks/error-handler.js +128 -0
  9. package/dist/api/hooks/error-handler.js.map +1 -0
  10. package/dist/api/plugins/auth/index.d.ts +78 -0
  11. package/dist/api/plugins/auth/index.js +300 -0
  12. package/dist/api/plugins/auth/index.js.map +1 -0
  13. package/dist/api/plugins/auth/keys.d.ts +23 -0
  14. package/dist/api/plugins/auth/keys.js +100 -0
  15. package/dist/api/plugins/auth/keys.js.map +1 -0
  16. package/dist/api/plugins/auth/strategies/legacy.d.ts +46 -0
  17. package/dist/api/plugins/auth/strategies/legacy.js +87 -0
  18. package/dist/api/plugins/auth/strategies/legacy.js.map +1 -0
  19. package/dist/api/plugins/auth/strategies/pat.d.ts +37 -0
  20. package/dist/api/plugins/auth/strategies/pat.js +99 -0
  21. package/dist/api/plugins/auth/strategies/pat.js.map +1 -0
  22. package/dist/api/plugins/auth/strategies/session.d.ts +37 -0
  23. package/dist/api/plugins/auth/strategies/session.js +30 -0
  24. package/dist/api/plugins/auth/strategies/session.js.map +1 -0
  25. package/dist/api/plugins/auth/strategies/types.d.ts +12 -0
  26. package/dist/api/plugins/auth/strategies/types.js +2 -0
  27. package/dist/api/plugins/auth/strategies/types.js.map +1 -0
  28. package/dist/api/plugins/auth.d.ts +29 -0
  29. package/dist/api/plugins/auth.js +30 -0
  30. package/dist/api/plugins/auth.js.map +1 -0
  31. package/dist/api/plugins/swagger.d.ts +31 -0
  32. package/dist/api/plugins/swagger.js +83 -0
  33. package/dist/api/plugins/swagger.js.map +1 -0
  34. package/dist/api/routes/auth/auth-error.d.ts +23 -0
  35. package/dist/api/routes/auth/auth-error.js +68 -0
  36. package/dist/api/routes/auth/auth-error.js.map +1 -0
  37. package/dist/api/routes/auth/callback.d.ts +44 -0
  38. package/dist/api/routes/auth/callback.js +175 -0
  39. package/dist/api/routes/auth/callback.js.map +1 -0
  40. package/dist/api/routes/auth/csrf.d.ts +24 -0
  41. package/dist/api/routes/auth/csrf.js +75 -0
  42. package/dist/api/routes/auth/csrf.js.map +1 -0
  43. package/dist/api/routes/auth/device-code.d.ts +41 -0
  44. package/dist/api/routes/auth/device-code.js +51 -0
  45. package/dist/api/routes/auth/device-code.js.map +1 -0
  46. package/dist/api/routes/auth/device-disabled-stub.d.ts +33 -0
  47. package/dist/api/routes/auth/device-disabled-stub.js +16 -0
  48. package/dist/api/routes/auth/device-disabled-stub.js.map +1 -0
  49. package/dist/api/routes/auth/device-html.d.ts +41 -0
  50. package/dist/api/routes/auth/device-html.js +243 -0
  51. package/dist/api/routes/auth/device-html.js.map +1 -0
  52. package/dist/api/routes/auth/device-token.d.ts +38 -0
  53. package/dist/api/routes/auth/device-token.js +153 -0
  54. package/dist/api/routes/auth/device-token.js.map +1 -0
  55. package/dist/api/routes/auth/disabled-stub.d.ts +31 -0
  56. package/dist/api/routes/auth/disabled-stub.js +21 -0
  57. package/dist/api/routes/auth/disabled-stub.js.map +1 -0
  58. package/dist/api/routes/auth/index.d.ts +65 -0
  59. package/dist/api/routes/auth/index.js +47 -0
  60. package/dist/api/routes/auth/index.js.map +1 -0
  61. package/dist/api/routes/auth/login.d.ts +27 -0
  62. package/dist/api/routes/auth/login.js +91 -0
  63. package/dist/api/routes/auth/login.js.map +1 -0
  64. package/dist/api/routes/auth/logout.d.ts +29 -0
  65. package/dist/api/routes/auth/logout.js +43 -0
  66. package/dist/api/routes/auth/logout.js.map +1 -0
  67. package/dist/api/routes/comments/index.d.ts +3 -0
  68. package/dist/api/routes/comments/index.js +74 -0
  69. package/dist/api/routes/comments/index.js.map +1 -0
  70. package/dist/api/routes/comments/schemas.d.ts +37 -0
  71. package/dist/api/routes/comments/schemas.js +24 -0
  72. package/dist/api/routes/comments/schemas.js.map +1 -0
  73. package/dist/api/routes/dependencies/index.d.ts +3 -0
  74. package/dist/api/routes/dependencies/index.js +60 -0
  75. package/dist/api/routes/dependencies/index.js.map +1 -0
  76. package/dist/api/routes/dependencies/schemas.d.ts +24 -0
  77. package/dist/api/routes/dependencies/schemas.js +15 -0
  78. package/dist/api/routes/dependencies/schemas.js.map +1 -0
  79. package/dist/api/routes/events.d.ts +3 -0
  80. package/dist/api/routes/events.js +157 -0
  81. package/dist/api/routes/events.js.map +1 -0
  82. package/dist/api/routes/health.d.ts +27 -0
  83. package/dist/api/routes/health.js +231 -0
  84. package/dist/api/routes/health.js.map +1 -0
  85. package/dist/api/routes/me/index.d.ts +3 -0
  86. package/dist/api/routes/me/index.js +8 -0
  87. package/dist/api/routes/me/index.js.map +1 -0
  88. package/dist/api/routes/me/profile.d.ts +3 -0
  89. package/dist/api/routes/me/profile.js +58 -0
  90. package/dist/api/routes/me/profile.js.map +1 -0
  91. package/dist/api/routes/me/tokens.d.ts +3 -0
  92. package/dist/api/routes/me/tokens.js +410 -0
  93. package/dist/api/routes/me/tokens.js.map +1 -0
  94. package/dist/api/routes/projects/dependency-graph.d.ts +26 -0
  95. package/dist/api/routes/projects/dependency-graph.js +56 -0
  96. package/dist/api/routes/projects/dependency-graph.js.map +1 -0
  97. package/dist/api/routes/projects/index.d.ts +3 -0
  98. package/dist/api/routes/projects/index.js +96 -0
  99. package/dist/api/routes/projects/index.js.map +1 -0
  100. package/dist/api/routes/projects/schemas.d.ts +37 -0
  101. package/dist/api/routes/projects/schemas.js +27 -0
  102. package/dist/api/routes/projects/schemas.js.map +1 -0
  103. package/dist/api/routes/projects/topology.d.ts +27 -0
  104. package/dist/api/routes/projects/topology.js +51 -0
  105. package/dist/api/routes/projects/topology.js.map +1 -0
  106. package/dist/api/routes/tasks/index.d.ts +3 -0
  107. package/dist/api/routes/tasks/index.js +330 -0
  108. package/dist/api/routes/tasks/index.js.map +1 -0
  109. package/dist/api/routes/tasks/schemas.d.ts +316 -0
  110. package/dist/api/routes/tasks/schemas.js +129 -0
  111. package/dist/api/routes/tasks/schemas.js.map +1 -0
  112. package/dist/api/routes/web/index.d.ts +23 -0
  113. package/dist/api/routes/web/index.js +30 -0
  114. package/dist/api/routes/web/index.js.map +1 -0
  115. package/dist/api/routes/web/login.d.ts +20 -0
  116. package/dist/api/routes/web/login.js +20 -0
  117. package/dist/api/routes/web/login.js.map +1 -0
  118. package/dist/api/routes/web/me.d.ts +23 -0
  119. package/dist/api/routes/web/me.js +31 -0
  120. package/dist/api/routes/web/me.js.map +1 -0
  121. package/dist/api/routes/web/tokens.d.ts +29 -0
  122. package/dist/api/routes/web/tokens.js +65 -0
  123. package/dist/api/routes/web/tokens.js.map +1 -0
  124. package/dist/api/server.d.ts +44 -0
  125. package/dist/api/server.js +521 -0
  126. package/dist/api/server.js.map +1 -0
  127. package/dist/api/start.d.ts +1 -0
  128. package/dist/api/start.js +79 -0
  129. package/dist/api/start.js.map +1 -0
  130. package/dist/cli/api/client.d.ts +126 -0
  131. package/dist/cli/api/client.js +408 -0
  132. package/dist/cli/api/client.js.map +1 -0
  133. package/dist/cli/api/errors.d.ts +16 -0
  134. package/dist/cli/api/errors.js +20 -0
  135. package/dist/cli/api/errors.js.map +1 -0
  136. package/dist/cli/api/types.d.ts +205 -0
  137. package/dist/cli/api/types.js +15 -0
  138. package/dist/cli/api/types.js.map +1 -0
  139. package/dist/cli/auth/browser-open.d.ts +1 -0
  140. package/dist/cli/auth/browser-open.js +116 -0
  141. package/dist/cli/auth/browser-open.js.map +1 -0
  142. package/dist/cli/auth/credentials.d.ts +27 -0
  143. package/dist/cli/auth/credentials.js +179 -0
  144. package/dist/cli/auth/credentials.js.map +1 -0
  145. package/dist/cli/auth/device-flow.d.ts +75 -0
  146. package/dist/cli/auth/device-flow.js +149 -0
  147. package/dist/cli/auth/device-flow.js.map +1 -0
  148. package/dist/cli/bin/tasks-client.d.ts +2 -0
  149. package/dist/cli/bin/tasks-client.js +86 -0
  150. package/dist/cli/bin/tasks-client.js.map +1 -0
  151. package/dist/cli/bin/tasks.d.ts +3 -0
  152. package/dist/cli/bin/tasks.js +127 -0
  153. package/dist/cli/bin/tasks.js.map +1 -0
  154. package/dist/cli/commands/backup.d.ts +3 -0
  155. package/dist/cli/commands/backup.js +65 -0
  156. package/dist/cli/commands/backup.js.map +1 -0
  157. package/dist/cli/commands/claim.d.ts +2 -0
  158. package/dist/cli/commands/claim.js +37 -0
  159. package/dist/cli/commands/claim.js.map +1 -0
  160. package/dist/cli/commands/comment-add.d.ts +2 -0
  161. package/dist/cli/commands/comment-add.js +45 -0
  162. package/dist/cli/commands/comment-add.js.map +1 -0
  163. package/dist/cli/commands/comment-delete.d.ts +2 -0
  164. package/dist/cli/commands/comment-delete.js +56 -0
  165. package/dist/cli/commands/comment-delete.js.map +1 -0
  166. package/dist/cli/commands/comment-list.d.ts +2 -0
  167. package/dist/cli/commands/comment-list.js +56 -0
  168. package/dist/cli/commands/comment-list.js.map +1 -0
  169. package/dist/cli/commands/completed.d.ts +10 -0
  170. package/dist/cli/commands/completed.js +168 -0
  171. package/dist/cli/commands/completed.js.map +1 -0
  172. package/dist/cli/commands/completions.d.ts +10 -0
  173. package/dist/cli/commands/completions.js +179 -0
  174. package/dist/cli/commands/completions.js.map +1 -0
  175. package/dist/cli/commands/create.d.ts +2 -0
  176. package/dist/cli/commands/create.js +99 -0
  177. package/dist/cli/commands/create.js.map +1 -0
  178. package/dist/cli/commands/db-check.d.ts +3 -0
  179. package/dist/cli/commands/db-check.js +63 -0
  180. package/dist/cli/commands/db-check.js.map +1 -0
  181. package/dist/cli/commands/db-migrate-identities.d.ts +37 -0
  182. package/dist/cli/commands/db-migrate-identities.js +352 -0
  183. package/dist/cli/commands/db-migrate-identities.js.map +1 -0
  184. package/dist/cli/commands/db-mint-token.d.ts +33 -0
  185. package/dist/cli/commands/db-mint-token.js +150 -0
  186. package/dist/cli/commands/db-mint-token.js.map +1 -0
  187. package/dist/cli/commands/db.d.ts +10 -0
  188. package/dist/cli/commands/db.js +16 -0
  189. package/dist/cli/commands/db.js.map +1 -0
  190. package/dist/cli/commands/delete.d.ts +2 -0
  191. package/dist/cli/commands/delete.js +54 -0
  192. package/dist/cli/commands/delete.js.map +1 -0
  193. package/dist/cli/commands/dep-add.d.ts +2 -0
  194. package/dist/cli/commands/dep-add.js +43 -0
  195. package/dist/cli/commands/dep-add.js.map +1 -0
  196. package/dist/cli/commands/dep-list.d.ts +2 -0
  197. package/dist/cli/commands/dep-list.js +36 -0
  198. package/dist/cli/commands/dep-list.js.map +1 -0
  199. package/dist/cli/commands/dep-remove.d.ts +2 -0
  200. package/dist/cli/commands/dep-remove.js +55 -0
  201. package/dist/cli/commands/dep-remove.js.map +1 -0
  202. package/dist/cli/commands/doctor.d.ts +3 -0
  203. package/dist/cli/commands/doctor.js +139 -0
  204. package/dist/cli/commands/doctor.js.map +1 -0
  205. package/dist/cli/commands/health.d.ts +2 -0
  206. package/dist/cli/commands/health.js +28 -0
  207. package/dist/cli/commands/health.js.map +1 -0
  208. package/dist/cli/commands/list.d.ts +2 -0
  209. package/dist/cli/commands/list.js +103 -0
  210. package/dist/cli/commands/list.js.map +1 -0
  211. package/dist/cli/commands/login.d.ts +2 -0
  212. package/dist/cli/commands/login.js +210 -0
  213. package/dist/cli/commands/login.js.map +1 -0
  214. package/dist/cli/commands/logout.d.ts +31 -0
  215. package/dist/cli/commands/logout.js +184 -0
  216. package/dist/cli/commands/logout.js.map +1 -0
  217. package/dist/cli/commands/project-create.d.ts +2 -0
  218. package/dist/cli/commands/project-create.js +44 -0
  219. package/dist/cli/commands/project-create.js.map +1 -0
  220. package/dist/cli/commands/project-delete.d.ts +2 -0
  221. package/dist/cli/commands/project-delete.js +54 -0
  222. package/dist/cli/commands/project-delete.js.map +1 -0
  223. package/dist/cli/commands/project-list.d.ts +2 -0
  224. package/dist/cli/commands/project-list.js +55 -0
  225. package/dist/cli/commands/project-list.js.map +1 -0
  226. package/dist/cli/commands/project-show.d.ts +2 -0
  227. package/dist/cli/commands/project-show.js +38 -0
  228. package/dist/cli/commands/project-show.js.map +1 -0
  229. package/dist/cli/commands/project-update.d.ts +2 -0
  230. package/dist/cli/commands/project-update.js +56 -0
  231. package/dist/cli/commands/project-update.js.map +1 -0
  232. package/dist/cli/commands/show.d.ts +2 -0
  233. package/dist/cli/commands/show.js +38 -0
  234. package/dist/cli/commands/show.js.map +1 -0
  235. package/dist/cli/commands/stats.d.ts +3 -0
  236. package/dist/cli/commands/stats.js +81 -0
  237. package/dist/cli/commands/stats.js.map +1 -0
  238. package/dist/cli/commands/subtask-create.d.ts +2 -0
  239. package/dist/cli/commands/subtask-create.js +85 -0
  240. package/dist/cli/commands/subtask-create.js.map +1 -0
  241. package/dist/cli/commands/subtask-list.d.ts +2 -0
  242. package/dist/cli/commands/subtask-list.js +61 -0
  243. package/dist/cli/commands/subtask-list.js.map +1 -0
  244. package/dist/cli/commands/topology.d.ts +16 -0
  245. package/dist/cli/commands/topology.js +52 -0
  246. package/dist/cli/commands/topology.js.map +1 -0
  247. package/dist/cli/commands/update.d.ts +2 -0
  248. package/dist/cli/commands/update.js +90 -0
  249. package/dist/cli/commands/update.js.map +1 -0
  250. package/dist/cli/commands/whoami.d.ts +30 -0
  251. package/dist/cli/commands/whoami.js +201 -0
  252. package/dist/cli/commands/whoami.js.map +1 -0
  253. package/dist/cli/config/env.d.ts +4 -0
  254. package/dist/cli/config/env.js +25 -0
  255. package/dist/cli/config/env.js.map +1 -0
  256. package/dist/cli/output/error-handler.d.ts +5 -0
  257. package/dist/cli/output/error-handler.js +41 -0
  258. package/dist/cli/output/error-handler.js.map +1 -0
  259. package/dist/cli/output/formatters.d.ts +86 -0
  260. package/dist/cli/output/formatters.js +352 -0
  261. package/dist/cli/output/formatters.js.map +1 -0
  262. package/dist/cli/output/json-output.d.ts +39 -0
  263. package/dist/cli/output/json-output.js +50 -0
  264. package/dist/cli/output/json-output.js.map +1 -0
  265. package/dist/cli/output/spinner.d.ts +14 -0
  266. package/dist/cli/output/spinner.js +48 -0
  267. package/dist/cli/output/spinner.js.map +1 -0
  268. package/dist/cli/prompts/interactive.d.ts +25 -0
  269. package/dist/cli/prompts/interactive.js +80 -0
  270. package/dist/cli/prompts/interactive.js.map +1 -0
  271. package/dist/config/env.d.ts +182 -0
  272. package/dist/config/env.js +311 -0
  273. package/dist/config/env.js.map +1 -0
  274. package/dist/db/database.d.ts +11 -0
  275. package/dist/db/database.js +25 -0
  276. package/dist/db/database.js.map +1 -0
  277. package/dist/db/migrate.d.ts +10 -0
  278. package/dist/db/migrate.js +137 -0
  279. package/dist/db/migrate.js.map +1 -0
  280. package/dist/db/migrations/001-initial-schema.d.ts +3 -0
  281. package/dist/db/migrations/001-initial-schema.js +100 -0
  282. package/dist/db/migrations/001-initial-schema.js.map +1 -0
  283. package/dist/db/migrations/002-task-hierarchy-and-dependencies.d.ts +3 -0
  284. package/dist/db/migrations/002-task-hierarchy-and-dependencies.js +42 -0
  285. package/dist/db/migrations/002-task-hierarchy-and-dependencies.js.map +1 -0
  286. package/dist/db/migrations/003-comments-and-estimates.d.ts +3 -0
  287. package/dist/db/migrations/003-comments-and-estimates.js +36 -0
  288. package/dist/db/migrations/003-comments-and-estimates.js.map +1 -0
  289. package/dist/db/migrations/004-claim-protocol.d.ts +3 -0
  290. package/dist/db/migrations/004-claim-protocol.js +41 -0
  291. package/dist/db/migrations/004-claim-protocol.js.map +1 -0
  292. package/dist/db/migrations/005-backlogged-status.d.ts +3 -0
  293. package/dist/db/migrations/005-backlogged-status.js +156 -0
  294. package/dist/db/migrations/005-backlogged-status.js.map +1 -0
  295. package/dist/db/migrations/006-slack-channel-subscriptions.d.ts +3 -0
  296. package/dist/db/migrations/006-slack-channel-subscriptions.js +23 -0
  297. package/dist/db/migrations/006-slack-channel-subscriptions.js.map +1 -0
  298. package/dist/db/migrations/007-completed-at.d.ts +19 -0
  299. package/dist/db/migrations/007-completed-at.js +36 -0
  300. package/dist/db/migrations/007-completed-at.js.map +1 -0
  301. package/dist/db/migrations/008-identity-tables.d.ts +21 -0
  302. package/dist/db/migrations/008-identity-tables.js +84 -0
  303. package/dist/db/migrations/008-identity-tables.js.map +1 -0
  304. package/dist/db/migrations/009-parallel-fk-columns.d.ts +33 -0
  305. package/dist/db/migrations/009-parallel-fk-columns.js +62 -0
  306. package/dist/db/migrations/009-parallel-fk-columns.js.map +1 -0
  307. package/dist/db/migrations/010-identity-uniqueness-indexes.d.ts +47 -0
  308. package/dist/db/migrations/010-identity-uniqueness-indexes.js +65 -0
  309. package/dist/db/migrations/010-identity-uniqueness-indexes.js.map +1 -0
  310. package/dist/db/migrations/011-acceptance-criteria.d.ts +30 -0
  311. package/dist/db/migrations/011-acceptance-criteria.js +41 -0
  312. package/dist/db/migrations/011-acceptance-criteria.js.map +1 -0
  313. package/dist/db/migrations/012-verification-evidence.d.ts +41 -0
  314. package/dist/db/migrations/012-verification-evidence.js +49 -0
  315. package/dist/db/migrations/012-verification-evidence.js.map +1 -0
  316. package/dist/events/event-bus.d.ts +101 -0
  317. package/dist/events/event-bus.js +184 -0
  318. package/dist/events/event-bus.js.map +1 -0
  319. package/dist/events/sse-manager.d.ts +79 -0
  320. package/dist/events/sse-manager.js +220 -0
  321. package/dist/events/sse-manager.js.map +1 -0
  322. package/dist/events/types.d.ts +43 -0
  323. package/dist/events/types.js +22 -0
  324. package/dist/events/types.js.map +1 -0
  325. package/dist/index.d.ts +110 -0
  326. package/dist/index.js +209 -0
  327. package/dist/index.js.map +1 -0
  328. package/dist/lib/audit/schema.d.ts +201 -0
  329. package/dist/lib/audit/schema.js +141 -0
  330. package/dist/lib/audit/schema.js.map +1 -0
  331. package/dist/lib/decompose/schema.d.ts +157 -0
  332. package/dist/lib/decompose/schema.js +138 -0
  333. package/dist/lib/decompose/schema.js.map +1 -0
  334. package/dist/lib/loop-run/integration-audit-schema.d.ts +78 -0
  335. package/dist/lib/loop-run/integration-audit-schema.js +68 -0
  336. package/dist/lib/loop-run/integration-audit-schema.js.map +1 -0
  337. package/dist/lib/loop-run/schema.d.ts +49 -0
  338. package/dist/lib/loop-run/schema.js +67 -0
  339. package/dist/lib/loop-run/schema.js.map +1 -0
  340. package/dist/mcp/errors.d.ts +11 -0
  341. package/dist/mcp/errors.js +29 -0
  342. package/dist/mcp/errors.js.map +1 -0
  343. package/dist/mcp/identity-resolution.d.ts +76 -0
  344. package/dist/mcp/identity-resolution.js +189 -0
  345. package/dist/mcp/identity-resolution.js.map +1 -0
  346. package/dist/mcp/index.d.ts +1 -0
  347. package/dist/mcp/index.js +126 -0
  348. package/dist/mcp/index.js.map +1 -0
  349. package/dist/mcp/remote/index.d.ts +21 -0
  350. package/dist/mcp/remote/index.js +95 -0
  351. package/dist/mcp/remote/index.js.map +1 -0
  352. package/dist/mcp/remote/register-tools.d.ts +26 -0
  353. package/dist/mcp/remote/register-tools.js +751 -0
  354. package/dist/mcp/remote/register-tools.js.map +1 -0
  355. package/dist/mcp/remote/rest-client.d.ts +66 -0
  356. package/dist/mcp/remote/rest-client.js +300 -0
  357. package/dist/mcp/remote/rest-client.js.map +1 -0
  358. package/dist/mcp/resources/events.d.ts +28 -0
  359. package/dist/mcp/resources/events.js +98 -0
  360. package/dist/mcp/resources/events.js.map +1 -0
  361. package/dist/mcp/server.d.ts +59 -0
  362. package/dist/mcp/server.js +72 -0
  363. package/dist/mcp/server.js.map +1 -0
  364. package/dist/mcp/tools/comment-tools.d.ts +12 -0
  365. package/dist/mcp/tools/comment-tools.js +115 -0
  366. package/dist/mcp/tools/comment-tools.js.map +1 -0
  367. package/dist/mcp/tools/dependency-tools.d.ts +3 -0
  368. package/dist/mcp/tools/dependency-tools.js +91 -0
  369. package/dist/mcp/tools/dependency-tools.js.map +1 -0
  370. package/dist/mcp/tools/health-tools.d.ts +9 -0
  371. package/dist/mcp/tools/health-tools.js +82 -0
  372. package/dist/mcp/tools/health-tools.js.map +1 -0
  373. package/dist/mcp/tools/project-tools.d.ts +13 -0
  374. package/dist/mcp/tools/project-tools.js +167 -0
  375. package/dist/mcp/tools/project-tools.js.map +1 -0
  376. package/dist/mcp/tools/task-tools.d.ts +41 -0
  377. package/dist/mcp/tools/task-tools.js +434 -0
  378. package/dist/mcp/tools/task-tools.js.map +1 -0
  379. package/dist/mcp/tools/topology-tools.d.ts +14 -0
  380. package/dist/mcp/tools/topology-tools.js +46 -0
  381. package/dist/mcp/tools/topology-tools.js.map +1 -0
  382. package/dist/repositories/api-token.repository.d.ts +40 -0
  383. package/dist/repositories/api-token.repository.js +63 -0
  384. package/dist/repositories/api-token.repository.js.map +1 -0
  385. package/dist/repositories/comment.repository.d.ts +17 -0
  386. package/dist/repositories/comment.repository.js +73 -0
  387. package/dist/repositories/comment.repository.js.map +1 -0
  388. package/dist/repositories/dependency.repository.d.ts +19 -0
  389. package/dist/repositories/dependency.repository.js +55 -0
  390. package/dist/repositories/dependency.repository.js.map +1 -0
  391. package/dist/repositories/errors.d.ts +29 -0
  392. package/dist/repositories/errors.js +48 -0
  393. package/dist/repositories/errors.js.map +1 -0
  394. package/dist/repositories/interfaces.d.ts +200 -0
  395. package/dist/repositories/interfaces.js +2 -0
  396. package/dist/repositories/interfaces.js.map +1 -0
  397. package/dist/repositories/project.repository.d.ts +21 -0
  398. package/dist/repositories/project.repository.js +97 -0
  399. package/dist/repositories/project.repository.js.map +1 -0
  400. package/dist/repositories/row-mapper.d.ts +40 -0
  401. package/dist/repositories/row-mapper.js +38 -0
  402. package/dist/repositories/row-mapper.js.map +1 -0
  403. package/dist/repositories/task.repository.d.ts +45 -0
  404. package/dist/repositories/task.repository.js +612 -0
  405. package/dist/repositories/task.repository.js.map +1 -0
  406. package/dist/repositories/types.d.ts +20 -0
  407. package/dist/repositories/types.js +11 -0
  408. package/dist/repositories/types.js.map +1 -0
  409. package/dist/repositories/user.repository.d.ts +121 -0
  410. package/dist/repositories/user.repository.js +209 -0
  411. package/dist/repositories/user.repository.js.map +1 -0
  412. package/dist/schemas/comment.schema.d.ts +24 -0
  413. package/dist/schemas/comment.schema.js +27 -0
  414. package/dist/schemas/comment.schema.js.map +1 -0
  415. package/dist/schemas/dependency-graph.schema.d.ts +181 -0
  416. package/dist/schemas/dependency-graph.schema.js +98 -0
  417. package/dist/schemas/dependency-graph.schema.js.map +1 -0
  418. package/dist/schemas/dependency.schema.d.ts +9 -0
  419. package/dist/schemas/dependency.schema.js +16 -0
  420. package/dist/schemas/dependency.schema.js.map +1 -0
  421. package/dist/schemas/idempotency.schema.d.ts +18 -0
  422. package/dist/schemas/idempotency.schema.js +22 -0
  423. package/dist/schemas/idempotency.schema.js.map +1 -0
  424. package/dist/schemas/task.schema.d.ts +369 -0
  425. package/dist/schemas/task.schema.js +276 -0
  426. package/dist/schemas/task.schema.js.map +1 -0
  427. package/dist/schemas/topology.schema.d.ts +56 -0
  428. package/dist/schemas/topology.schema.js +48 -0
  429. package/dist/schemas/topology.schema.js.map +1 -0
  430. package/dist/services/auth-audit.d.ts +46 -0
  431. package/dist/services/auth-audit.js +28 -0
  432. package/dist/services/auth-audit.js.map +1 -0
  433. package/dist/services/claim-release.service.d.ts +42 -0
  434. package/dist/services/claim-release.service.js +90 -0
  435. package/dist/services/claim-release.service.js.map +1 -0
  436. package/dist/services/comment.service.d.ts +44 -0
  437. package/dist/services/comment.service.js +96 -0
  438. package/dist/services/comment.service.js.map +1 -0
  439. package/dist/services/dependency-graph.service.d.ts +33 -0
  440. package/dist/services/dependency-graph.service.js +453 -0
  441. package/dist/services/dependency-graph.service.js.map +1 -0
  442. package/dist/services/dependency.service.d.ts +32 -0
  443. package/dist/services/dependency.service.js +79 -0
  444. package/dist/services/dependency.service.js.map +1 -0
  445. package/dist/services/device-flow-store.d.ts +155 -0
  446. package/dist/services/device-flow-store.js +323 -0
  447. package/dist/services/device-flow-store.js.map +1 -0
  448. package/dist/services/errors.d.ts +28 -0
  449. package/dist/services/errors.js +44 -0
  450. package/dist/services/errors.js.map +1 -0
  451. package/dist/services/idempotency.service.d.ts +37 -0
  452. package/dist/services/idempotency.service.js +54 -0
  453. package/dist/services/idempotency.service.js.map +1 -0
  454. package/dist/services/identity-seeder.d.ts +56 -0
  455. package/dist/services/identity-seeder.js +131 -0
  456. package/dist/services/identity-seeder.js.map +1 -0
  457. package/dist/services/oidc-boot.d.ts +73 -0
  458. package/dist/services/oidc-boot.js +66 -0
  459. package/dist/services/oidc-boot.js.map +1 -0
  460. package/dist/services/oidc-client.d.ts +99 -0
  461. package/dist/services/oidc-client.js +108 -0
  462. package/dist/services/oidc-client.js.map +1 -0
  463. package/dist/services/pat-hash.d.ts +23 -0
  464. package/dist/services/pat-hash.js +73 -0
  465. package/dist/services/pat-hash.js.map +1 -0
  466. package/dist/services/pat-touch-debounce.d.ts +65 -0
  467. package/dist/services/pat-touch-debounce.js +82 -0
  468. package/dist/services/pat-touch-debounce.js.map +1 -0
  469. package/dist/services/project.service.d.ts +41 -0
  470. package/dist/services/project.service.js +133 -0
  471. package/dist/services/project.service.js.map +1 -0
  472. package/dist/services/slack.service.d.ts +31 -0
  473. package/dist/services/slack.service.js +52 -0
  474. package/dist/services/slack.service.js.map +1 -0
  475. package/dist/services/task.service.d.ts +151 -0
  476. package/dist/services/task.service.js +425 -0
  477. package/dist/services/task.service.js.map +1 -0
  478. package/dist/services/topology.service.d.ts +65 -0
  479. package/dist/services/topology.service.js +170 -0
  480. package/dist/services/topology.service.js.map +1 -0
  481. package/dist/services/user-upsert.d.ts +43 -0
  482. package/dist/services/user-upsert.js +53 -0
  483. package/dist/services/user-upsert.js.map +1 -0
  484. package/dist/services/workflow-engine.d.ts +93 -0
  485. package/dist/services/workflow-engine.js +250 -0
  486. package/dist/services/workflow-engine.js.map +1 -0
  487. package/dist/slack/commands/tasks-command.d.ts +88 -0
  488. package/dist/slack/commands/tasks-command.js +920 -0
  489. package/dist/slack/commands/tasks-command.js.map +1 -0
  490. package/dist/slack/formatters/project-formatter.d.ts +19 -0
  491. package/dist/slack/formatters/project-formatter.js +94 -0
  492. package/dist/slack/formatters/project-formatter.js.map +1 -0
  493. package/dist/slack/notifier.d.ts +41 -0
  494. package/dist/slack/notifier.js +111 -0
  495. package/dist/slack/notifier.js.map +1 -0
  496. package/dist/slack/repositories/channel-subscription.repository.d.ts +25 -0
  497. package/dist/slack/repositories/channel-subscription.repository.js +51 -0
  498. package/dist/slack/repositories/channel-subscription.repository.js.map +1 -0
  499. package/dist/slack/task-formatter.d.ts +31 -0
  500. package/dist/slack/task-formatter.js +151 -0
  501. package/dist/slack/task-formatter.js.map +1 -0
  502. package/dist/slack/user-identity.d.ts +37 -0
  503. package/dist/slack/user-identity.js +70 -0
  504. package/dist/slack/user-identity.js.map +1 -0
  505. package/dist/types/identity.d.ts +84 -0
  506. package/dist/types/identity.js +6 -0
  507. package/dist/types/identity.js.map +1 -0
  508. package/dist/types/task.d.ts +202 -0
  509. package/dist/types/task.js +17 -0
  510. package/dist/types/task.js.map +1 -0
  511. package/dist/utils/cycle-detector.d.ts +25 -0
  512. package/dist/utils/cycle-detector.js +86 -0
  513. package/dist/utils/cycle-detector.js.map +1 -0
  514. package/dist/utils/exit-codes.d.ts +64 -0
  515. package/dist/utils/exit-codes.js +57 -0
  516. package/dist/utils/exit-codes.js.map +1 -0
  517. package/dist/utils/is-main.d.ts +12 -0
  518. package/dist/utils/is-main.js +24 -0
  519. package/dist/utils/is-main.js.map +1 -0
  520. package/dist/utils/version.d.ts +1 -0
  521. package/dist/utils/version.js +22 -0
  522. package/dist/utils/version.js.map +1 -0
  523. package/dist/web/html.d.ts +73 -0
  524. package/dist/web/html.js +154 -0
  525. package/dist/web/html.js.map +1 -0
  526. package/dist/web/pages/device.d.ts +19 -0
  527. package/dist/web/pages/device.js +76 -0
  528. package/dist/web/pages/device.js.map +1 -0
  529. package/dist/web/pages/error.d.ts +6 -0
  530. package/dist/web/pages/error.js +23 -0
  531. package/dist/web/pages/error.js.map +1 -0
  532. package/dist/web/pages/login.d.ts +5 -0
  533. package/dist/web/pages/login.js +22 -0
  534. package/dist/web/pages/login.js.map +1 -0
  535. package/dist/web/pages/me.d.ts +9 -0
  536. package/dist/web/pages/me.js +37 -0
  537. package/dist/web/pages/me.js.map +1 -0
  538. package/dist/web/pages/tokens.d.ts +20 -0
  539. package/dist/web/pages/tokens.js +89 -0
  540. package/dist/web/pages/tokens.js.map +1 -0
  541. package/dist/web/session-constants.d.ts +21 -0
  542. package/dist/web/session-constants.js +22 -0
  543. package/dist/web/session-constants.js.map +1 -0
  544. package/dist/web/session-flash.d.ts +15 -0
  545. package/dist/web/session-flash.js +11 -0
  546. package/dist/web/session-flash.js.map +1 -0
  547. package/dist/web/session-user.d.ts +59 -0
  548. package/dist/web/session-user.js +44 -0
  549. package/dist/web/session-user.js.map +1 -0
  550. package/docs/AGENT_CONTEXT.md +280 -0
  551. package/docs/README.md +49 -0
  552. package/llms.txt +33 -0
  553. package/package.json +129 -0
package/AGENTS.md ADDED
@@ -0,0 +1,112 @@
1
+ # AGENTS.md
2
+
3
+ Owner: Repository maintainers
4
+
5
+ First-read navigation hub for any AI coding agent working on `wood-fired-tasks`. Vendor-neutral. Points at deeper docs; does not duplicate them. The full contract is in [docs/AGENT_CONTEXT.md](docs/AGENT_CONTEXT.md).
6
+
7
+ ## What is wood-fired-tasks
8
+
9
+ `wood-fired-tasks` is a single-repo TypeScript task-tracking system that exposes the same underlying data through three surfaces and one notification channel:
10
+
11
+ - A **Fastify REST API** (`src/api/`) for HTTP clients.
12
+ - An **MCP server** (`src/mcp/`, `@modelcontextprotocol/sdk`) so AI agents can read and mutate tasks as tools.
13
+ - A **Commander CLI** named `tasks` (`src/cli/`) for terminal users.
14
+ - A **Slack bolt** notifier (`src/slack/`) that posts task lifecycle events.
15
+
16
+ All three surfaces sit on a shared core: typed Zod schemas (`src/schemas/`), services (`src/services/`), repositories (`src/repositories/`), and a **better-sqlite3** database (`src/db/`) with umzug migrations. Tests are vitest; lint is biome; Node ≥ 22 ESM throughout. Run `npm run dev` for the REST API, `npm run mcp:dev` for the MCP server, `npm run cli -- <command>` for the CLI. Everything else (build, lint, tests, migrations) is `npm run …`. There is no separate frontend, microservice, or background worker — one process per surface, one shared SQLite file, one TypeScript codebase.
17
+
18
+ ## Read-next by intent
19
+
20
+ Pick your intent, read the files in order. Files marked `(reserved)` are slots defined by the contract but not yet on disk in this milestone.
21
+
22
+ | Intent | Read in this order |
23
+ |---|---|
24
+ | docs-only change | `docs/AGENT_CONTEXT.md` → `CONTRIBUTING.md` → the doc you are editing |
25
+ | API change (REST routes) | `docs/API.md` → `src/api/routes/` → an existing test in `src/api/__tests__/` → `docs/INTERFACES.md` |
26
+ | MCP tool change | `docs/MCP.md` → `src/mcp/tools/` → `src/mcp/__tests__/` → `docs/INTERFACES.md` |
27
+ | CLI change | `docs/CLI.md` → `src/cli/commands/` → `src/cli/__tests__/` |
28
+ | Schema / status / enum change | `src/schemas/` → matching `src/services/` or `src/repositories/` → API/MCP/CLI surface that exposes it |
29
+ | Database migration | `src/db/migrations/` → `src/db/migrate.ts` → `src/db/__tests__/` → `docs/ARCHITECTURE.md` |
30
+ | Slack change | `docs/SLACK.md` → `src/slack/` → `slack-app-manifest.yml` |
31
+ | Test-only fix | failing test file → the unit under test → `vitest.config.ts` |
32
+ | Release / docs update | `docs/RELEASE.md` → `CHANGELOG.md` → `package.json` |
33
+ | Deploying your fork to production | `docs/SETUP.md` (Self-hosting and upgrades) → `deploy/install.sh` → `deploy/upgrade.sh` → `docs/RELEASE.md` (Migration expectations) |
34
+
35
+ For per-surface change recipes (18 task shapes with files / tests / docs), see [`docs/NAVIGATION.md`](docs/NAVIGATION.md).
36
+
37
+ ## Essential commands
38
+
39
+ | Purpose | Command |
40
+ |---|---|
41
+ | Install dependencies | `npm ci` |
42
+ | Build (and typecheck) | `npm run build` |
43
+ | Lint | `npm run lint` |
44
+ | Focused test file | `npx vitest run path/to/file.test.ts` |
45
+ | Focused test by name | `npx vitest run -t "name pattern"` |
46
+ | Full test suite | `npm test` |
47
+ | Local REST API server | `npm run dev` |
48
+ | Local MCP server (stdio) | `npm run mcp:dev` |
49
+ | Remote MCP server (HTTP) | `npm run build && npm run mcp:remote` |
50
+ | Run a migration | `npm run migrate` |
51
+ | Run the CLI in-tree | `npm run cli -- <args>` |
52
+ | Full quality gate | `npm run quality` |
53
+
54
+ `npm run build` is the project's typecheck — there is no separate `tsc --noEmit` script.
55
+
56
+ ## High-risk / handle-with-care areas
57
+
58
+ Treat these as off-limits unless your task explicitly requires touching them.
59
+
60
+ - `data/`, `*.db`, `*.db-wal`, `*.db-shm` — gitignored SQLite files; commonly hold **real task data**. Never commit, never delete blindly, never assume schema from byte layout — read `src/db/migrations/` instead.
61
+ - `dist/` — gitignored build output; regenerated by `npm run build`. Never hand-edit.
62
+ - `coverage/`, `reports/`, `.stryker-tmp/` — gitignored test artifacts. Safe to delete; never commit.
63
+ - `.env`, `.env.local` — gitignored; carry credentials and tokens. Never paste contents into chat, logs, or commits. Use `.env.example` as the template.
64
+ - `.gitleaks-report.json` — gitignored secret-scan output. Local-only.
65
+ - `/bin/` — gitignored client install artifacts. `bin/tasks.cmd` may contain a **baked-in API key** from a local install; do not commit, share, or read its contents into context.
66
+ - `.planning/`, `.claude/`, `.codex/`, `.agents/`, `.bug-smash-*.md` — gitignored workspace dirs. Not part of the shipped repo; do not rely on them.
67
+
68
+ ## Deeper docs
69
+
70
+ | File | One-line purpose |
71
+ |---|---|
72
+ | [README.md](README.md) | Product-level overview, install, quickstart |
73
+ | [CONTRIBUTING.md](CONTRIBUTING.md) | Human contributor workflow, commit and PR rules |
74
+ | [docs/AGENT_CONTEXT.md](docs/AGENT_CONTEXT.md) | Authoritative contract for agent-facing files |
75
+ | [docs/API.md](docs/API.md) | REST API reference |
76
+ | [docs/MCP.md](docs/MCP.md) | MCP tool reference |
77
+ | [docs/CLI.md](docs/CLI.md) | CLI reference |
78
+ | [docs/SETUP.md](docs/SETUP.md) | Local setup, env, install |
79
+ | [docs/SLACK.md](docs/SLACK.md) | Slack integration reference |
80
+ | [docs/RELEASE.md](docs/RELEASE.md) | Release process |
81
+ | [docs/CODE_QUALITY_ROADMAP.md](docs/CODE_QUALITY_ROADMAP.md) | Quality roadmap |
82
+ | [docs/ONBOARDING_SMOKE.md](docs/ONBOARDING_SMOKE.md) | Onboarding smoke test — 7 probe scenarios for fresh agents |
83
+ | [docs/REPO_MAP.md](docs/REPO_MAP.md) | Compact repo tree with per-directory ownership |
84
+ | [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) | System one-pager, data flow across surfaces |
85
+ | [docs/WORKFLOWS.md](docs/WORKFLOWS.md) | Canonical command recipes (build, test, lint, run) |
86
+ | [docs/INTERFACES.md](docs/INTERFACES.md) | Inventory of REST routes, MCP tools, CLI commands (counts verified by CI) |
87
+ | [docs/NAVIGATION.md](docs/NAVIGATION.md) | Task-oriented "if you want to do X, read these files" index |
88
+ | [docs/ONBOARDING_SMOKE.md](docs/ONBOARDING_SMOKE.md) | Repeatable onboarding smoke test (scripted + manual) |
89
+ | [docs/TROUBLESHOOTING.md](docs/TROUBLESHOOTING.md) | Operator recovery runbook: boot failures, wrong/stale DB, safe backup/restore |
90
+ | [.agent-context.json](.agent-context.json) | Machine-readable manifest of the files above |
91
+
92
+ ## Task-orchestration skills (`/tasks:*`)
93
+
94
+ This repo ships agent skills under `skills/tasks/` that automate the
95
+ plan→execute→audit loop over a wood-fired-tasks project. They install to
96
+ `~/.claude/commands/tasks/` via `install.sh`. The orchestration set:
97
+
98
+ | Skill | Status | One-line purpose |
99
+ |---|---|---|
100
+ | `/tasks:decompose` | OPERATIONAL | Break a project-level goal into 8–25 leaf tasks (or a dependency DAG) ready for an executor. Planner only — never executes. See [`skills/tasks/decompose.md`](skills/tasks/decompose.md) and the design at [`docs/tasks-decompose-design.md`](docs/tasks-decompose-design.md). |
101
+ | `/tasks:loop` | OPERATIONAL | Drain a FLAT-topology backlog sequentially. See [`skills/tasks/loop.md`](skills/tasks/loop.md). |
102
+ | `/tasks:loop-dag` | OPERATIONAL | Drain a DAG-topology backlog wave-by-wave in parallel. See [`skills/tasks/loop-dag.md`](skills/tasks/loop-dag.md). |
103
+ | `/tasks:audit` | OPERATIONAL | Retroactively grade a completed loop run. See [`skills/tasks/audit.md`](skills/tasks/audit.md). |
104
+
105
+ Typical flow: `/tasks:decompose` a goal → run `/tasks:loop` (FLAT advisory)
106
+ or `/tasks:loop-dag` (DAG advisory) → `/tasks:audit` the run. Decompose
107
+ plans and hands off; the executors run; the auditor grades — three separate
108
+ orchestrators by design.
109
+
110
+ ## Vendor neutrality
111
+
112
+ `AGENTS.md` is the authoritative entry point for every agent, regardless of vendor. Vendor-specific files (`CLAUDE.md`, `.cursor/`, `.gemini/`, `.codex/`, any future `.<vendor>/`) MAY exist but MUST be either thin pointers back here or vendor-only configuration (slash commands, MCP client wiring, tool allow-lists). They MUST NOT carry unique project facts; if you find one that does, move the content into the authoritative tier (`AGENTS.md` or `docs/**`) and replace the vendor file with a pointer. The full boundary rules are in [docs/AGENT_CONTEXT.md §6](docs/AGENT_CONTEXT.md).
package/CHANGELOG.md ADDED
@@ -0,0 +1,271 @@
1
+ # Changelog
2
+
3
+ All notable changes to this project are documented in this file.
4
+
5
+ The format is based on [Keep a Changelog 1.1.0](https://keepachangelog.com/en/1.1.0/),
6
+ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
7
+
8
+ Each release groups changes under `Added`, `Changed`, `Fixed`, and `Security`.
9
+ Security-relevant items (auth, secret handling, network exposure, dependency
10
+ vulnerabilities, supply-chain pinning) are always called out under `Security`.
11
+
12
+ ## [Unreleased]
13
+
14
+ ## [v1.12] - 2026-05-25
15
+
16
+ First public open-source release. OSS-launch readiness and CI sharding work landed since v1.11.
17
+
18
+ ### Added
19
+ - `docs/TROUBLESHOOTING.md` operator recovery runbook (boot failures, wrong/stale DB, safe backup/restore); linked from AGENTS.md, README, and the docs index (task 355).
20
+ - Tool-count drift regression test for public docs (task 260).
21
+ - `.env.example` aligned with documented config (task 259).
22
+
23
+ ### Changed
24
+ - License relicensed from ISC to MIT for OSS launch (task 253).
25
+ - SECURITY.md rewritten for the actual TypeScript/Fastify stack (task 254).
26
+ - OSS package metadata + npm `files` allowlist (task 255).
27
+ - Installer split into local vs. remote MCP paths; `--api-key` flag deprecated (still parsed and honored, emits a deprecation warning — prefer `WOOD_FIRED_TASKS_API_KEY`, the per-user secret file, or the interactive prompt) (task 258).
28
+ - Stryker mutation tests sharded across 4 parallel CI jobs; threshold raised to 75; workflow timeout extended (tasks 250, 252).
29
+ - Shipped systemd unit (`deploy/wood-fired-tasks.service`) now orders after `network-online.target` so OIDC discovery doesn't crash-loop the service on a cold boot; `StartLimitBurst` raised to 5 (task 353).
30
+ - `docs/MCP.md` now recommends the remote (REST) variant as the single-writer default, warns that the local direct-SQLite variant silently serves stale data, and documents a launcher-wrapper that keeps the API key out of client config (task 356).
31
+
32
+ ### Fixed
33
+ - Test runs cleanly clean up `task.status_changed` listeners between runs (task 257).
34
+
35
+ ## [v1.11] - 2026-05-21
36
+
37
+ Coverage ratchet, CLI bare-spot tests, and workflow engine cascade-rollback fix.
38
+
39
+ ### Added
40
+ - Vitest coverage thresholds ratcheted past 80/80/70 (task 249).
41
+ - Test coverage for remote MCP rest-client + register-tools (task 249).
42
+ - Test coverage for CLI bare-spot commands `completed`/`completions`/`db-check`/`doctor` (task 249).
43
+ - Test coverage for CLI interactive prompts (task 249).
44
+ - Test coverage for CLI formatters + JSON output (task 249).
45
+
46
+ ### Fixed
47
+ - Workflow engine no longer leaks phantom events during cascade rollback (task 244).
48
+
49
+ ## [v1.10] - 2026-05-21
50
+
51
+ Pagination envelope, schema-derived CLI types, and a new MCP completion-report tool.
52
+
53
+ ### Added
54
+ - `completion_report` tool on the remote MCP server (task 245).
55
+
56
+ ### Changed
57
+ - List endpoints documented with paginated envelope shape (task 248).
58
+ - CLI `TaskResponse` derived from the server Zod schema instead of being hand-maintained (task 246).
59
+ - CLI shell-completions command list derived from the Commander registry (task 247).
60
+
61
+ ### Fixed
62
+ - Dropped duplicate `metadata.range` field in `tasks completed --json` output.
63
+
64
+ ## [v1.9] - 2026-05-20
65
+
66
+ Documentation sweep for OSS launch — README, CONTRIBUTING, CHANGELOG, API/CLI/MCP docs, and de-personalized fixtures/scripts.
67
+
68
+ ### Added
69
+ - `CHANGELOG.md` with backfill of recent security-relevant changes (task 217).
70
+ - GitHub issue and PR templates (task 232).
71
+ - CONTRIBUTING.md expanded for external contributors (task 229).
72
+
73
+ ### Changed
74
+ - README badges, refreshed test counts, canonical URLs, branding sweep (task 238).
75
+ - SETUP, Slack, data model, env vars, and architecture docs expanded (task 214).
76
+ - MCP docs corrected: tool count, remote server, events resource (task 220).
77
+ - CLI docs document 6 previously-missing commands; fixed `claim` JSON shape (task 223).
78
+ - API docs corrected: endpoint surface, `/health` & swagger, env, filters (task 227).
79
+ - Test fixtures de-personalized with generic names (task 237).
80
+ - Deploy scripts de-personalized via `WFT_SERVICE_USER` (task 236).
81
+
82
+ ## [v1.8] - 2026-05-20
83
+
84
+ Pre-OSS hardening — test coverage, mutation testing, and performance regression
85
+ gates added as part of the open-source audit.
86
+
87
+ ### Added
88
+ - Vitest `bench` suite for hot-path perf regression (task 212).
89
+ - v8 coverage reporter + CI threshold gate (task 199).
90
+ - Stryker mutation score enforcement in CI (task 203).
91
+ - Cross-platform install-script smoke tests + linters (task 202).
92
+ - OpenAPI snapshot for contract drift detection (task 207).
93
+
94
+ ### Changed
95
+ - Expanded fast-check property tests over service invariants (tasks 200, 209).
96
+ - CLI snapshot + real-binary end-to-end tests (tasks 208, 211).
97
+ - Migrations verified via up→down→up schema snapshots (task 201).
98
+
99
+ ### Fixed
100
+ - `install.sh` `TEMP_FILES` expansion under `set -u` on bash 3.2.
101
+ - CI shellcheck scoped to `install.sh`; tests excluded from `tsc` build.
102
+ - SSE fan-out and Slack request-signing regression coverage (tasks 205, 206).
103
+
104
+ ### Security
105
+ - Generalized personal/internal examples in docs and tests pre-OSS.
106
+
107
+ ## [v1.7] - 2026-05-20
108
+
109
+ Security audit remediation release — concentrated mitigation of pre-OSS
110
+ security review findings.
111
+
112
+ ### Changed
113
+ - Default HTTP bind moved to `127.0.0.1` (task 188).
114
+ - `limit` / `offset` pagination on list endpoints (task 192).
115
+
116
+ ### Fixed
117
+ - DELETE comment validates task ownership (task 191).
118
+ - Slack `subscribe` event types validated against allowlist (task 198).
119
+
120
+ ### Security
121
+ - Untracked `.planning/` and internal agent dirs (task 186 prep).
122
+ - Documented `.env` handling, scrubbed working-tree secrets (task 187).
123
+ - Admin trust model documented + per-key labels (task 189).
124
+ - Removed live API key from events MCP resource markdown (task 196).
125
+ - Removed hardcoded internal LAN IP (task 190).
126
+ - SSE map stores hashed API-key fingerprint, not raw key (task 194).
127
+ - `install.sh` escapes API keys via `jq -n --arg` (task 195).
128
+ - All GitHub Actions pinned to commit SHAs (task 197).
129
+
130
+ ## [v1.6] - 2026-05-20
131
+
132
+ First wave of security-audit fixes plus client-package / remote-MCP work.
133
+
134
+ ### Added
135
+ - Remote MCP proxy server backed by the REST API for thin clients (quick-6).
136
+ - Client package with `setup.bat`/`uninstall.*` scripts and bundled CLI.
137
+ - `updated_after` / `updated_before` filters on `GET /tasks` (task 100).
138
+ - Completion-report dashboard (task 97).
139
+
140
+ ### Changed
141
+ - `list_tasks` MCP response trimmed to compact summaries by default.
142
+ - Migration name normalization prevents `.ts` / `.js` mismatch crashes.
143
+
144
+ ### Fixed
145
+ - Startup retries for transient SQLite errors in MCP entry point.
146
+ - Migrations serialized with exclusive SQLite transaction lock (quick-5).
147
+ - `SlackService` logger type widened to `FastifyBaseLogger`.
148
+ - Client install handles spaces in paths and PowerShell 5.1.
149
+
150
+ ### Security
151
+ - Reduced unauthenticated public surface, bounded SSE connections (task 185).
152
+ - Hardened API-key auth against weak keys + brute force (task 182).
153
+ - Upgraded vulnerable prod deps + CI `npm audit` gate (task 181).
154
+ - Validated FTS search input, mapped syntax errors to 400 (task 183).
155
+ - Secured API-key handling across all installer scripts (task 184).
156
+
157
+ ## [v1.5] - 2026-02-18
158
+
159
+ Slack integration milestone.
160
+
161
+ ### Added
162
+ - Slack Bolt integration (`SlackService`) with channel subscriptions and
163
+ `subscribe`/`unsubscribe` command surface (phases 23–26).
164
+ - `tasks` slash-command router with task/project/dep/comment/subtask/health
165
+ subcommands and Block Kit formatters.
166
+ - `UserIdentityCache` for Slack user ID → display name resolution.
167
+ - `SlackNotifier` subscribed to EventBus with retry and per-channel error
168
+ isolation.
169
+
170
+ ### Changed
171
+ - Slack token config validated both-or-neither via Zod.
172
+
173
+ ## [v1.4] - 2026-02-17
174
+
175
+ Reliability, UX polish, and CI quality gates.
176
+
177
+ ### Added
178
+ - `tasks doctor`, `tasks stats`, `tasks db-check` diagnostics (phase 19).
179
+ - `tasks backup` CLI command + `backlogged` status (phase 18).
180
+ - Property-based tests for `CycleDetector` and status transitions (phase 20).
181
+ - Stryker mutation testing; knip unused-dep detection; GitHub Actions CI.
182
+ - Request IDs, MCP `traceId` logging, reduced SSE buffer.
183
+
184
+ ### Changed
185
+ - Phase 17 Core Reliability work landed across 4 plans.
186
+ - Phase 21 UX polish: spinner, color utils, shell completions.
187
+
188
+ ### Fixed
189
+ - Sweep no longer reverts `done`/`closed` tasks (quick-4).
190
+ - CLI `apiRequest` handles HTTP 204; SSE returns 400 on missing `Accept`.
191
+
192
+ ### Security
193
+ - systemd unit gains resource limits + security hardening (phase 22).
194
+
195
+ ## [v1.3] - 2026-02-14
196
+
197
+ Workflow engine, atomic task-claim protocol, and SSE event stream.
198
+
199
+ ### Added
200
+ - `EventBus` with generics + Task/Project CRUD emissions (phase 14).
201
+ - `GET /api/v1/events` SSE endpoint, `SSEManager` with buffering.
202
+ - Atomic claim protocol (CAS + `BEGIN IMMEDIATE`), `claim_task` MCP tool,
203
+ `tasks claim` CLI, stale-claim auto-release service (phase 15).
204
+ - `WorkflowEngine` parent auto-complete with cascade depth + dependency
205
+ auto-unblock (phase 16).
206
+
207
+ ### Changed
208
+ - `@fastify/sse` API usage corrected for v0.4.0.
209
+
210
+ ## [v1.2] - 2026-02-14
211
+
212
+ Installers, Claude Code skills, and documentation.
213
+
214
+ ### Added
215
+ - Bash and PowerShell installer scripts (phase 13).
216
+ - Claude Code skill files: `create-task`, `log-bug`, `my-work`, `show-task`,
217
+ `pick-up`, `search`, `add-comment`, `done`, `blocked`, `project-status`
218
+ (phase 12).
219
+ - `README.md`, `docs/SETUP.md`, `docs/API.md`, `docs/CLI.md`, `docs/MCP.md`.
220
+ - E2E regression suite and skill-file validation tests.
221
+
222
+ ### Fixed
223
+ - Redirected Umzug logger to stderr so MCP stdio output stays clean.
224
+
225
+ ## [v1.1] - 2026-02-13
226
+
227
+ CLI expansion, MCP tool surface, JSON mode.
228
+
229
+ ### Added
230
+ - Project, dependency, comment, subtask, and health CLI commands
231
+ (phases 08-01 through 08-05).
232
+ - MCP project tools, `list_subtasks` task tool, and `check_health` health
233
+ tool (phase 09).
234
+ - Global `--json`, `--no-input`, `--force` flags and `@clack/prompts`
235
+ interactive prompts (phase 07).
236
+ - `NO_COLOR` environment variable support.
237
+
238
+ ### Fixed
239
+ - HTTP client only sends `Content-Type` when the request has a body.
240
+ - `dotenv` stdout contamination suppressed so JSON output stays clean.
241
+
242
+ ## [v1.0] - 2026-02-13
243
+
244
+ Initial tagged release — REST API, CLI, MCP server, SQLite backing store,
245
+ and the task/project/dependency/comment/subtask domain model.
246
+
247
+ ### Added
248
+ - Fastify REST API: task + project CRUD, auth, error handler, health,
249
+ OpenAPI docs (phase 02).
250
+ - CLI with API client + task `create`/`list`/`update`/`delete`/`show`
251
+ commands (phase 03).
252
+ - MCP server with task CRUD tools + error conversion (phase 04).
253
+ - systemd service unit + production entry point with graceful shutdown
254
+ (phase 05-01).
255
+ - SQLite backup/restore scripts with cron schedule (phase 05-02).
256
+ - Task hierarchy (subtasks), dependency service, comments, time estimates
257
+ (phase 06).
258
+
259
+ [Unreleased]: https://github.com/Wood-Fired-Games/wood-fired-tasks/compare/v1.11...HEAD
260
+ [v1.11]: https://github.com/Wood-Fired-Games/wood-fired-tasks/compare/v1.10...v1.11
261
+ [v1.10]: https://github.com/Wood-Fired-Games/wood-fired-tasks/compare/v1.9...v1.10
262
+ [v1.9]: https://github.com/Wood-Fired-Games/wood-fired-tasks/compare/v1.8...v1.9
263
+ [v1.8]: https://github.com/Wood-Fired-Games/wood-fired-tasks/compare/v1.7...v1.8
264
+ [v1.7]: https://github.com/Wood-Fired-Games/wood-fired-tasks/compare/v1.6...v1.7
265
+ [v1.6]: https://github.com/Wood-Fired-Games/wood-fired-tasks/compare/v1.5...v1.6
266
+ [v1.5]: https://github.com/Wood-Fired-Games/wood-fired-tasks/compare/v1.4...v1.5
267
+ [v1.4]: https://github.com/Wood-Fired-Games/wood-fired-tasks/compare/v1.3...v1.4
268
+ [v1.3]: https://github.com/Wood-Fired-Games/wood-fired-tasks/compare/v1.2...v1.3
269
+ [v1.2]: https://github.com/Wood-Fired-Games/wood-fired-tasks/compare/v1.1...v1.2
270
+ [v1.1]: https://github.com/Wood-Fired-Games/wood-fired-tasks/compare/v1.0...v1.1
271
+ [v1.0]: https://github.com/Wood-Fired-Games/wood-fired-tasks/releases/tag/v1.0
package/CLAUDE.md ADDED
@@ -0,0 +1,21 @@
1
+ # CLAUDE.md
2
+
3
+ > See [AGENTS.md](AGENTS.md) for the canonical, vendor-neutral agent entry
4
+ > point. This file exists so Claude Code automatically discovers the project
5
+ > context — it is an **adapter** with no unique facts.
6
+
7
+ ## What to read first
8
+
9
+ 1. [AGENTS.md](AGENTS.md) — first-read navigation hub.
10
+ 2. [docs/AGENT_CONTEXT.md](docs/AGENT_CONTEXT.md) — the contract that
11
+ defines what counts as canonical agent context here.
12
+ 3. [.agent-context.json](.agent-context.json) — machine-readable manifest.
13
+
14
+ ## Maintenance
15
+
16
+ - This file MUST stay a thin pointer. The contract is in
17
+ [docs/AGENT_CONTEXT.md](docs/AGENT_CONTEXT.md) §6.2.
18
+ - The freshness check (`npm run agent-context:check`) verifies that every
19
+ link target exists; the manifest classifies this file as `authority: adapter`.
20
+ - Project-specific Claude Code config (slash commands, hooks, MCP client
21
+ wiring) lives in `.claude/` (gitignored). Do not mirror facts here.
package/LICENSE ADDED
@@ -0,0 +1,21 @@
1
+ MIT License
2
+
3
+ Copyright (c) 2026 Wood Fired Games
4
+
5
+ Permission is hereby granted, free of charge, to any person obtaining a copy
6
+ of this software and associated documentation files (the "Software"), to deal
7
+ in the Software without restriction, including without limitation the rights
8
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9
+ copies of the Software, and to permit persons to whom the Software is
10
+ furnished to do so, subject to the following conditions:
11
+
12
+ The above copyright notice and this permission notice shall be included in all
13
+ copies or substantial portions of the Software.
14
+
15
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21
+ SOFTWARE.